[Autogenerated] I'll be inside the plural site labs environment and
we'll be operating on a Linux graphical endpoint.
The first thing we want to do is start a network capture.
I'll open up Wireshark.
We'll add a capture filter to limit the packets to only DNS and
then double-click E zero to start capturing.
Now let's create some DNS traffic the way it's typically done.
I'll open up Firefox and we'll browse to www dot plurals site dot com.
That's enough traffic to start with.
So let's return to Wireshark and stop the capture.
By default,
Firefox will be making DNS requests out to Mozilla
servicess as part of its normal operations.
When it starts up to limit our traffic to what we just did.
We can use a filter to look for the word plural site anywhere in the frame.
Now, let's click on the first packet and expand the DNS section.
The first query is an a query resulting in an IPv4
address for Pluralsight dot com.
This is the most common form of DNS request.
If we click on the second result,
we can see something interesting as part of your web request.
This automatically initiated two DNS queries the second is a
quad a query resulting in an IPv6 address.
Now let's take a look at the response worth noting the
IP header contains IPv4 information.
This is not the DNS answer.
This is the communication between the host making
the request and the DNS server.
In this case, 172 31 0.2 typical DNS operates over UDP.
This means there's no error checking or tracking in the network communication.
Because of this,
the DNS server will return a copy of the original query in the
response to ensure they stay matched up,
looking at the answers reveals more than what we might expect.
The top result is a CNA record which stands for canonical name.
Simply put this points to a valid alias for plurals site dot com.
In this case, www dot plurals site dot com dot CD N dot Cloudflare .NET,
Cloudflare hosts the plural site webpage.
So they own the root domains.
Next is two a records containing the IPv4 answers.
It's very common for popular domains to have multiple
ips for things like load balancing.
So despite a single web request,
there are quite a few packets with a decent amount of information in them.
This is where you might start to see how DNS starts
to get a bit more complicated.
Let's take a look at another way we can perform DNS queries.
And for this, I'll open up a terminal.
We'll be using a command line tool called NSL.
Look up.
Starting off, we'll perform the same query as we did before.
Just like we saw in Wireshark,
we can see 2 IPv4 answers and 2 IPv6 answers returned with the CNA at the top.
If we want only a specific record returned, we can use the dash query option.
And if we want the full response information, we can use the dash debug option.
This provides a much more detailed response including the time to live values
and any additional record information that is returned.
Finally,
we can use SLC up to perform a reverse DNS look up by
requesting a pointer record and sending the IP address
because of how DNS records are stored.
We have to enter the IP in reverse order.
For example, 104 19 162 127 becomes 127 162 19.104.
What's returned is interesting.
The result is local host.
Despite us knowing that the IP we gave belongs to plurals site dot com.
This is actually a security strategy to bypass source
address checks in a way to prevent individuals from
performing pointer lookups for some domains.